Data Protection Exhibit
LeapGreat GmbH · Version 2026.8 · Effective 3 August 2026 · The English version of this document governs.
Data Protection Exhibit · Information Security Exhibit
This Data Protection Exhibit (the “Exhibit”) describes how LeapGreat GmbH (“LeapGreat”, “we” or “our”) protects and processes personal data on behalf of its customers, and the safeguards it applies to international data transfers. It is published by LeapGreat and forms part of, and is incorporated by reference into, the Terms and Conditions for LeapGreat Software Subscriptions and Services (the “Terms”) and each Order (together, the “Agreement”). It applies wherever LeapGreat processes Personal Data on a customer’s behalf, to customers in North America and Europe (including the United Kingdom and Switzerland).
1. SCOPE, ROLES AND DEFINITIONS
Scope. This Exhibit applies where, and to the extent that, LeapGreat processes Personal Data on behalf of the Customer in connection with Subscription and Services. Where the Customer does not provide Personal Data to LeapGreat, this Exhibit does not apply.
Roles. The Customer is the controller (or processes on behalf of a third-party controller) and LeapGreat is the processor. LeapGreat processes Personal Data only on the Customer’s documented instructions — as set out in the Agreement, the Order and this Exhibit — unless required by law and uses Personal Data for its own purposes only as required by law or to establish, exercise or defend legal claims; data LeapGreat derives is aggregated and anonymized. LeapGreat will inform the Customer if, in its opinion, an instruction infringes applicable Data Protection Laws; LeapGreat is not otherwise obliged to check the lawfulness of the Customer’s instructions.
“Personal Data” means personal information relating to an identified or identifiable individual that is contained in the Customer Data (referred to as “Personal Information” in the Terms). The Customer will not input special-category data unless separately agreed in writing.
“Data Protection Laws” means the data-protection and privacy laws applicable to the processing, including, as relevant, the EU General Data Protection Regulation (“EU GDPR”), the UK GDPR and Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), and applicable United States state privacy laws and Canadian privacy laws (including PIPEDA).
2. DESCRIPTION OF THE PROCESSING
| Item | Description |
|---|---|
| Categories of data subjects | The individuals whose Personal Data is contained in the Customer Data, typically the Customer’s Users, personnel and business contacts. |
| Categories of Personal Data | The Personal Data contained in the Customer Data that the Customer provides or inputs, typically user account and business contact data (such as first and last name, business email address, and profile, project and role assignments). |
| Sensitive data | None, unless separately agreed in writing. |
| Frequency | Continuous, for the duration of the Subscription. |
| Nature of the processing | Hosting, storage and processing of Customer Data by automated means to provide the Subscription and Services. In standard operation of the AI-assisted features, only structural business-process metadata is transmitted to the AI model; live and test-execution data are architecturally separated from AI processing. |
| Purpose(s) | Provision of the Subscription and Services to the Customer, as instructed by the Customer through its use of them and as set out in the Agreement. |
| Duration / retention | For the Term, until Personal Data is deleted or returned in accordance with the Agreement (see Section 7). Sub-processors retain Personal Data only as long as needed to provide their services to LeapGreat. |
| Sub-processors | As set out in Section 4. |
3. TECHNICAL AND ORGANISATIONAL MEASURES
The technical and organizational measures LeapGreat implements to ensure the security of Personal Data, including the ongoing confidentiality, integrity, availability and resilience of processing systems and services, are those set out in the LeapGreat Information Security Exhibit (the “Information Security Exhibit”), which is incorporated into this Exhibit; the current version is published by LeapGreat.
In summary, and as further described in the Information Security Exhibit, those measures include: TLS 1.3 encryption in transit and AES-256 encryption at rest; secure authentication (including OAuth2) and role-based access control on a least-privilege basis; logical segregation of each customer’s data (tenant isolation); audit logging of administrative and write-back operations; daily backup and recovery aligned to the applicable service levels; security monitoring and at least annual independent penetration testing; personnel confidentiality obligations and training; and containment, mitigation and notification of security breaches. For the AI-assisted features: only structural business-process metadata is transmitted to the AI model; live and test-execution data are architecturally separated from AI processing; functional role names are used instead of personal identifiers; and AI-generated content is marked as such and subject to human review before adoption.
Breach notification. LeapGreat will notify the Customer of a personal data breach affecting Personal Data without undue delay after becoming aware of it. To the extent the Information Security Exhibit or any other document specifies a different notification period, the timing in this Exhibit prevails; stricter notification periods may be agreed in an Order.
4. AUTHORISED SUB-PROCESSORS
The Customer authorises LeapGreat to engage the sub-processors listed below. LeapGreat has entered into a written agreement with each sub-processor imposing data-protection obligations that are substantially similar to those applicable to LeapGreat under the Agreement and this Exhibit, and LeapGreat remains responsible for each sub-processor’s performance. This is a general authorisation: LeapGreat may add or replace sub-processors from time to time. LeapGreat will notify customers of the addition or replacement of a sub-processor at least 30 days before it takes effect, by updating the published page and informing the Customer’s account contact. If the Customer objects on reasonable data-protection grounds and no resolution is found, the Customer may terminate the affected Subscription with effect from the date the change takes effect. Which sub-processors are engaged for a given Customer follows the hosting region and AI deployment model that apply to the Order: EEA hosting is the default for EEA customers, and Anthropic is engaged only where LeapGreat-managed AI is ordered — in each case unless otherwise agreed in the Order. The current list of authorised sub-processors is maintained by LeapGreat and made available to the Customer at any time within the LeapGreat Software (Sub-Processors page).
| Sub-processor | Role / service | Location & transfer mechanism |
|---|---|---|
| Microsoft Azure (Microsoft Ireland Operations Ltd.) | Cloud hosting and infrastructure for the LeapGreat Platform and Customer Data. | EU regions West Europe (Netherlands) / North Europe (Ireland) by default for EEA customers — intra-EEA, no third-country transfer. Other regions apply only where otherwise agreed in the Order; Microsoft is DPF-certified (EU Data Boundary enabled) and the EU SCCs apply as fallback where a non-EU region is agreed. |
| LeapGreat Inc. (group affiliate) | Platform support and maintenance via remote access to the hosted system. | United States. Remote access from the US to EU-hosted data is treated as a transfer (EDPB Guidelines 05/2021); safeguarded by intra-group EU SCCs (Module Three) between LeapGreat GmbH and LeapGreat Inc., incorporating the UK Addendum and Swiss adaptations. Access is ticket-bound, need-to-know and fully logged; no bulk export. |
| Anthropic, PBC (Claude API) | LLM inference for the EVA assistant — engaged only where the Customer orders LeapGreat-managed AI (Deployment Model A). | United States. Anthropic is certified under the EU–US Data Privacy Framework (including the UK Extension) and the Swiss–US DPF; the EU SCCs under Anthropic’s data processing agreement apply as fallback. A transfer impact assessment is maintained. |
Current United States transfers. Two limited US transfer scenarios currently arise: (a) remote support access by LeapGreat Inc. — treated as a transfer under EDPB Guidelines 05/2021 even though Customer Data remains hosted in Azure EU — safeguarded by intra-group EU SCCs (Module Three) between LeapGreat GmbH and LeapGreat Inc., with ticket-bound, logged, need-to-know access and no bulk export; and (b) LLM inference by Anthropic, PBC where the Customer orders LeapGreat-managed AI (Deployment Model A), safeguarded by Anthropic’s Data Privacy Framework certification and the EU SCCs under Anthropic’s data processing agreement. A transfer impact assessment covering both scenarios is maintained.
Not sub-processors (clarifications).
Atlassian (Jira): the Jira test-case integration writes into the Customer’s own Jira instance, so Atlassian acts as the Customer’s processor.
BYOK (customer-provided AI credentials). Where separately agreed in writing, the Customer may supply its own API credentials for a model provider under the Customer’s own agreement with that provider (e.g. OpenAI, Anthropic, Mistral). Any transmission of data to that provider occurs solely on the Customer’s documented instruction (Art. 28(3)(a) GDPR); the endpoint configuration in the Order or instance settings constitutes that instruction. The model provider is not a sub-processor of LeapGreat; the Customer bears sole responsibility for provider selection, contractual terms (in particular retention and training exclusion) and the lawfulness of any third-country transfers, and warrants that the required data processing agreement with the provider is in place. LeapGreat safeguards Customer-provided credentials (encrypted storage, rotation, revocation, no use beyond the Customer’s instance) per its technical and organizational measures. A customer-hosted LLM endpoint (BYOM) is not offered.
SAP SE receives no Personal Data from LeapGreat.
5. INTERNATIONAL DATA TRANSFERS
LeapGreat hosts and processes Customer Data on a dedicated single-tenant instance per customer in Microsoft Azure. For EEA customers the default regions are within the EEA (West Europe – Netherlands / North Europe – Ireland), so hosting itself involves no third-country transfer; other regions apply only where otherwise agreed in the Order. Where LeapGreat transfers Personal Data across a border to a country that has not been recognised as providing an adequate level of protection, LeapGreat relies on an approved transfer mechanism, as set out below. Where required, the details in Sections 1–4 populate the annexes to those mechanisms.
| Personal Data originating from | Applicable law | Transfer mechanism LeapGreat relies on |
|---|---|---|
| EEA / European Union | EU GDPR | The European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) (the “EU SCCs”), Module Three (processor-to-processor), reflecting LeapGreat’s role as the Customer’s processor; the details in Sections 1–4 serve as their annexes. For transfers to the United States, LeapGreat relies on its intra-group EU SCCs (support access by LeapGreat Inc.) and, where LeapGreat-managed AI is ordered, on Anthropic’s certification under the EU–US Data Privacy Framework (“DPF”), with the EU SCCs as fallback. |
| United Kingdom | UK GDPR / DPA 2018 | The UK International Data Transfer Agreement (IDTA), or the EU SCCs together with the UK Addendum issued by the ICO; LeapGreat’s intra-group SCCs incorporate the UK Addendum. Where LeapGreat-managed AI is ordered, Anthropic is certified under the UK Extension to the DPF. |
| Switzerland | Swiss FADP | The EU SCCs as adapted for Switzerland and recognized by the Federal Data Protection and Information Commissioner (FDPIC), with references construed under the FADP; LeapGreat’s intra-group SCCs incorporate the corresponding Swiss adaptations. Where LeapGreat-managed AI is ordered, Anthropic is certified under the Swiss–US DPF. |
| United States / Canada (North America) | US state privacy laws / PIPEDA | No cross-border restricted transfer mechanism is required for Personal Data originating in these countries. LeapGreat applies the same security and sub-processor commitments described in this Exhibit, and processes Personal Data only as a service provider / processor on the Customer’s instructions. |
6. ASSISTANCE, DATA-SUBJECT REQUESTS AND BREACH
Where reasonably practicable, LeapGreat will assist the Customer with data-subject requests and with the Customer’s obligations under Articles 32–36 of the EU/UK GDPR (and equivalent provisions of other Data Protection Laws), taking into account the nature of the processing and the information available to LeapGreat. LeapGreat will notify the Customer without undue delay of any breach affecting Personal Data. Assistance beyond that described here may incur Fees as set out in the Agreement.
Audits. LeapGreat makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections conducted by the Customer or an auditor mandated by the Customer. Audit requests are satisfied first through documentation (this Exhibit, the Information Security Exhibit and, on request, the most recent penetration-test summary); on-site inspections require 90 days’ prior notice, are limited to once per contract year, and are at the Customer’s expense.
7. RETENTION, RETURN AND DELETION
On termination or expiry of the Agreement, LeapGreat will return or delete Personal Data in accordance with the Agreement, except for copies required to be retained by law. LeapGreat’s standard retention period following termination is 60 days, unless a statutory retention obligation applies. Sub-processors retain Personal Data only as long as needed to provide their services to LeapGreat.
8. SUPERVISORY AUTHORITY, REPRESENTATIVE AND CONTACT
Competent supervisory authority. For EEA/EU processing, the supervisory authority of the EEA member state in which the Customer (or its Article 27 representative) is established, or, failing that, where the affected data subjects are located; for the United Kingdom, the Information Commissioner’s Office (ICO); for Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).
LeapGreat contact. LeapGreat GmbH, Dachauer Str. 46, 82140 Olching, Germany (Amtsgericht München HRB 291863). Data Protection Officer: privacy@leapgreat.com. LeapGreat GmbH is LeapGreat’s EU establishment; its lead supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach, Germany.
9. PRECEDENCE, CHANGES AND VERSIONING
In any conflict between this Exhibit and the body of the Terms regarding the processing of Personal Data, this Exhibit prevails. Each party’s liability in connection with such processing is subject to the limitations of liability in the Agreement. LeapGreat may update this Exhibit from time to time; updates will not materially reduce the protection of Personal Data during the current Term. The current version is published by LeapGreat at www.leapgreat.com/dataprotection and identified by its version and effective date. This version: Data Protection Exhibit v2026.8, effective 3 August 2026.
LeapGreat Inc. · Data protection contact: privacy@leapgreat.com
Prior versions are available in the version archive. This document is incorporated into the LeapGreat Terms & Conditions by reference.